Fixes for 5.10

[thirdparty/kernel/stable-queue.git] / queue-5.10 / octeontx2-af-avoid-off-by-one-read-from-userspace.patch

diff --git a/queue-5.10/octeontx2-af-avoid-off-by-one-read-from-userspace.patch b/queue-5.10/octeontx2-af-avoid-off-by-one-read-from-userspace.patch
new file mode 100644 (file)
index 0000000..988f8fb
--- /dev/null
+++ b/queue-5.10/octeontx2-af-avoid-off-by-one-read-from-userspace.patch
@@ -0,0 +1,44 @@
+From 549db89f02b86f78fa5175822540f9c9a6883e5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2024 21:44:23 +0700
+Subject: octeontx2-af: avoid off-by-one read from userspace
+
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+
+[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]
+
+We try to access count + 1 byte from userspace with memdup_user(buffer,
+count + 1). However, the userspace only provides buffer of count bytes and
+only these count bytes are verified to be okay to access. To ensure the
+copied buffer is NUL terminated, we use memdup_user_nul instead.
+
+Fixes: 3a2eb515d136 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
+Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-6-f1f1b53a10f4@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+index 5205796859f6c..d212bab3ddbae 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+@@ -420,12 +420,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,
+       u16 pcifunc;
+       int ret, lf;
+ 
+-      cmd_buf = memdup_user(buffer, count + 1);
++      cmd_buf = memdup_user_nul(buffer, count);
+       if (IS_ERR(cmd_buf))
+               return -ENOMEM;
+ 
+-      cmd_buf[count] = '\0';
+-
+       cmd_buf_tmp = strchr(cmd_buf, '\n');
+       if (cmd_buf_tmp) {
+               *cmd_buf_tmp = '\0';
+-- 
+2.43.0
+